Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Shopify Uses WebAssembly Outside of the Browser

shopify.engineering

Post reply on HN
Print view View original

41–50 of 135 posts

Re: How Shopify Uses WebAssembly Outside of the Browser

#41

Post by alquemist »

CyberRabbi wrote: post #33
tpetry wrote: post #29

Earlier quoted context omitted.

And i would run wasm with a seccomp profile: You have the benefit of language designed which is hard to not do anything malicious (i guess theres still some possibility) and harden the execution environment (wasm runner) within a rootless pofman/docker container with a seccomp profile and restrictive selinux labels. The world is not black and white, you can mix multiple solutions for more security. For what shopify i…

Using wasm in addition to seccomp-bpf (what you’re calling seccomp) strictly increases your attack surface. If you want to maximize security you would only use seccomp. Imagemagick is not trusted to process arbitrary data, otherwise there would be no need to use seccomp. Seccomp was specifically designed for running untrusted binaries. Check references if you do not believe me: https://en.wikipedia.org/wiki/Seccomp#H…

In a WASM + seccomp implementation, the whole WASM runtime runs inside seccomp. Breaking out of WASM leaves one running arbitrary asm inside seccomp, which has exactly the same attack surface as directly running untrusted binaries inside seccomp. The WASM layer in WASM + seccomp simply requires an additional exploit.

Re: How Shopify Uses WebAssembly Outside of the Browser

#42

Post by CyberRabbi »

feanaro wrote: post #39
CyberRabbi wrote: post #25

Earlier quoted context omitted.

Running untrusted code in a wasm vm doesn’t add any extra defense over just using seccomp. It just adds unnecessary overhead and increases attack surface.

seccomp escapes are a thing and if you're inside a restrictive environment such as WASM, it is harder to achieve it.

I think you’re referring to seccomp-bpf. seccomp has never been escaped and it is unlikely such a bug could happen due its simplicity. If you do not know the difference between seccomp and seccomp-bpf, please check references: https://en.wikipedia.org/wiki/Seccomp

Re: How Shopify Uses WebAssembly Outside of the Browser

#43

Post by CyberRabbi »

alquemist wrote: post #41
CyberRabbi wrote: post #33

Earlier quoted context omitted.

Using wasm in addition to seccomp-bpf (what you’re calling seccomp) strictly increases your attack surface. If you want to maximize security you would only use seccomp. Imagemagick is not trusted to process arbitrary data, otherwise there would be no need to use seccomp. Seccomp was specifically designed for running untrusted binaries. Check references if you do not believe me: https://en.wikipedia.org/wiki/Seccomp#H…

In a WASM + seccomp implementation, the whole WASM runtime runs inside seccomp. Breaking out of WASM leaves one running arbitrary asm inside seccomp, which has exactly the same attack surface as directly running untrusted binaries inside seccomp. The WASM layer in WASM + seccomp simply requires an additional exploit.

You’re referring to seccomp-bpf, not seccomp. Seccomp-bpf + wasm has a dramatically larger attack surface than just seccomp. Please check references if you do not know the difference between seccomp-bpf and seccomp: https://en.wikipedia.org/wiki/Seccomp

Re: How Shopify Uses WebAssembly Outside of the Browser

#44

Post by rattray »

TheGeminon wrote: post #37
rattray wrote: post #4

Earlier quoted context omitted.

I think this is super new - there are only two apps that offer subscriptions that integrate with Shopify Checkout, and one of them launched in November it seems and is still in beta: https://apps.shopify.com/collections/checkout-subscription

Yes, I work at Shopify and our first party subscription support just recently launched a few months ago.

Awesome! Very exciting. I recently launched a small business which has a natural subscriptions element (https://narwallmask.com - a mask with replacement filters, which you may want regularly) but without subs integrated into shopify checkout, I decided simply not to offer it. Maybe now I can!

Can you say whether wasm helped make this happen? Seems quite plausible to me...

Re: How Shopify Uses WebAssembly Outside of the Browser

#45

Post by rattray »

enriquto wrote: post #17
martin_drapeau wrote: post #14

Could someone eligthen me. Why not just use JavaScript? It is being used by Cloudflare on the edge, and AWS lambda. Why need to go to WASM?

The issue is quite symmetrical, isn't it? Somebody could ask: why not use just WASM? Why need to go to JavaScript? This is a better question, actually, if you already have a codebase in another language that can you can easily compile to wasm, but not to javascript.

Because as the article states, JavaScript is widely used by their plugin developers, while AssemblyScript is still nascent (little-used, missing features, has bugs).

Re: How Shopify Uses WebAssembly Outside of the Browser

#46

Post by CyberRabbi »

feanaro wrote: post #38
CyberRabbi wrote: post #33

Earlier quoted context omitted.

Using wasm in addition to seccomp-bpf (what you’re calling seccomp) strictly increases your attack surface. If you want to maximize security you would only use seccomp. Imagemagick is not trusted to process arbitrary data, otherwise there would be no need to use seccomp. Seccomp was specifically designed for running untrusted binaries. Check references if you do not believe me: https://en.wikipedia.org/wiki/Seccomp#H…

> Using wasm in addition to seccomp strictly increases your attack surface. If you want to maximize security you would only use seccomp. Huh? How so?

The wasm vm has to parse, validate, and compile untrusted input. It also exposes host calls. Those are all potential attack vectors. That’s at least roughly 50K LOC.

Re: How Shopify Uses WebAssembly Outside of the Browser

#47

Post by rattray »

alquemist wrote: post #26
martin_drapeau wrote: post #14

Could someone eligthen me. Why not just use JavaScript? It is being used by Cloudflare on the edge, and AWS lambda. Why need to go to WASM?

* Predictable performance. * A wide ecosystem of mature language toolchains. * Simplicity: JS implementation contain sophisticated JITs, which are harder to prove correct compared to a simple ASM translator. * Portability: not tied to a specific HW architecture.

For clarity, do you work at Shopify? These all sound like valid reasons, I'm just curious if they're the ones that motivated the Scripts team at Shopify.

Re: How Shopify Uses WebAssembly Outside of the Browser

#48

Post by [deleted] »

rattray wrote: post #47
alquemist wrote: post #26

Earlier quoted context omitted.

* Predictable performance. * A wide ecosystem of mature language toolchains. * Simplicity: JS implementation contain sophisticated JITs, which are harder to prove correct compared to a simple ASM translator. * Portability: not tied to a specific HW architecture.

For clarity, do you work at Shopify? These all sound like valid reasons, I'm just curious if they're the ones that motivated the Scripts team at Shopify.

[deleted]

Re: How Shopify Uses WebAssembly Outside of the Browser

#49

Post by CyberRabbi »

amelius wrote: post #35
jedisct1 wrote: post #32

Earlier quoted context omitted.

You can’t express anything malicious in JavaScript either, yet vulnerabilities are constantly found in web browsers, including WebAssembly JITs. You can express malicious things in Go, yet the number of RCEs in Go apps is pretty much zero.

> You can’t express anything malicious in JavaScript either You have to be more specific because lots of fraud is possible by misleading the user through JavaScript tricks.

Full device root from JavaScript https://github.com/synacktiv/PS4-webkit-exploit-6.XX
Post reply on HN